This question is an extension of How does Tor handle DNS poisoning.
If I have understood correctly, following happens when visiting
- Tor exit node resolves
example.comto an IP, e.g. 188.8.131.52
- End-to-end HTTPS encryption is established between Tor browser client and
Given an evil exit node resolves the domain name to a different IP address 184.108.40.206 owned by Mallory. Then the returned site still needs to deliver a certificate as response, which most probably is self-signed and not trusted by a browser root certificate authority. Hence I would get a certificate error in case of DNS spoofing.
Doesn't that mean, I am safe concerning DNS attacks, when enforcing HTTPS with Tor?